RustMC: Extending the GenMC stateless model checker to Rust

2025-02-10

AI Summary

This work addresses the challenge of verifying concurrent Rust programs—a longstanding open problem in formal methods. To overcome Rust-specific obstacles—including its unique compilation model, unsafe code, FFI calls, atomic operations, and uninitialized memory accesses—we extend the GenMC stateless model checker to the Rust ecosystem. Our approach introduces an LLVM IR–based symbolic execution framework, augmented with a customized Rust runtime interception mechanism, precise modeling of Rust’s memory model semantics, and explicit handling of uninitialized memory accesses. Crucially, it supports automatic verification of Rust programs with mixed C/C++ dependencies. This yields the first stateless concurrent verifier for Rust. Evaluated on real-world systems, our tool successfully detects diverse concurrency bugs, including unsafe code misuse, FFI-induced data races, and atomic operation logic errors. The work significantly advances the formal verification capabilities for Rust-based systems software.

Technology Category

• Reasoning under Uncertainty: Uncertainty Representations
• Multiagent Systems: Multiagent Systems under Uncertainty
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Virtualization and resource management in Web systems and infrastructures
• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

RustMC is a stateless model checker that enables verification of concurrent Rust programs. As both Rust and C/C++ compile to LLVM IR, RustMC builds on GenMC which provides a verification framework for LLVM IR. This enables the automatic verification of Rust code and any C/C++ dependencies. This tool paper presents the key challenges we addressed to extend GenMC. These challenges arise from Rust's unique compilation strategy and include intercepting threading operations, handling memory intrinsics and uninitialized accesses. Through case studies adapted from real-world programs, we demonstrate RustMC's effectiveness at finding concurrency bugs stemming from unsafe Rust code, FFI calls to C/C++, and incorrect use of atomic operations.

Problem

• Verifying concurrent Rust programs
• Handling Rust's unique compilation challenges
• Detecting concurrency bugs in unsafe Rust code

Innovation

• Extends GenMC for Rust
• Handles Rust's unique compilation
• Verifies concurrent Rust programs